CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
ezsystems/ezpublish-kernelPackagisteZ Publish Remote code execution in file uploadsNo scoreezsystems/ezplatformPackagisteZ Platform Prevent accepting app.php in URL in Platform.shNo scoreezsystems/ezpublish-kernelPackagisteZ Platform REST API returns list of all SiteAccessesNo scoreezsystems/ezplatformPackagisteZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)No scoreezsystems/ezplatformPackagisteZ Platform CSRF token in login form is disabled by defaultNo scoreezsystems/ezplatform-userPackagisteZ Platform Admin UI Password reset vulnerabilityNo scoreezsystems/ezplatform-kernelPackagisteZ Platform Object Injection in SiteAccessMatchListenerNo scoreezsystems/ezplatform-admin-uiPackagisteZ Platform Admin UI Cross-site Scripting vulnerabilityNo scoreezsystems/ezplatform-admin-uiPackagisteZ Platform Password reset vulnerabilityNo scoreezsystems/ezplatform-admin-ui-assetsPackagisteZ Platform Editor Cross-site Scripting (XSS)No scoreezsystems/ezplatform-admin-ui-assetsPackagisteZ Platform Bundled jQuery affected by CVE-2019-11358No scoreezsystems/ezfind-lsPackagistCross-site Scripting in eZFind spellcheckNo scoreezsystems/ez-support-toolsPackagistezsystems/ez-support-tools Failing access control in system info viewNo scoreezsystems/ezdemo-ls-extensionPackagistCross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJSNo scoreezsystems/demobundlePackagistCross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJSNo scoreendroid/qr-code-bundlePackagistendroid/qr-code-bundle File Disclosure via logo_path query parameterNo scoredrupal/drupalPackagistDrupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library4.6 Mediumdrupal/drupalPackagistDrupal core Arbitrary PHP code execution7.8 Highdrupal/drupalPackagistDrupal core uses a vulnerable Third-party library CKEditor4.2 Mediumdrupal/drupalPackagistDrupal core Open Redirect vulnerability4.3 Mediumdrupal/drupalPackagistDrupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar8.1 Highdrupal/drupalPackagistDrupal core Access control bypass4.3 Medium- campcodes online examination systemCampcodes Online Examination System exam.php sql injection5.3 Medium
drupal/drupalPackagistDrupal core Denial of Service5.3 Mediumdrupal/drupalPackagistDrupal core Remote Code ExecutionNo scoredrupal/drupalPackagistDrupal Core Insufficient Contextual Links validation leads to Remote Code ExecutionNo scoredrupal/drupalPackagistDrupal Malicious file upload with filenames stating with dotNo scoredrupal/drupalPackagistDrupal Anonymous Open Redirect5.8 Mediumdrupal/drupalPackagistDrupal Content moderation Access bypassNo scoredrupal/drupalPackagistDrupal External URL injection through URL aliases leading to Open RedirectNo scoredrupal/corePackagistDrupal core Cross-Site Scripting (XSS) vulnerabilities5.3 Mediumdrupal/corePackagistDrupal core Arbitrary PHP code execution7.8 Highdrupal/corePackagistDrupal core Open Redirect vulnerability4.3 Mediumdrupal/corePackagistDrupal core uses a vulnerable Third-party library CKEditor4.2 Medium- zoom video communications, inc. workplace vdi app for windows, zoom vdi windows meeting client, workplace virtual desktop infrastructure +2 moreZoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity6.7 Medium
drupal/corePackagistDrupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar8.1 Highdrupal/corePackagistDrupal core Access bypass4.3 Mediumdrupal/corePackagistDrupal core unrestricted file upload6.6 Medium- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a...6.5 Medium
- google chrome, fedoraproject fedora +1 moreUse after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to...6.5 Medium
- google chrome, fedoraproject fedora +1 moreUse after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to...6.5 Medium
- google chrome, fedoraproject fedora, google chromium v8 +2 moreType Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute...9.6 Critical
drupal/corePackagistDrupal core Denial of Service5.3 Medium- zoom workplace, meeting software development kit, workplace desktop +2 more +4 moreZoom Apps - Buffer Overflow6.5 Medium
drupal/corePackagistDrupal Core Insufficient Contextual Links validation leads to Remote Code ExecutionNo score- xpdfOut-of-bounds array write in Xpdf 4.05 due to missing object type check2.1 Low
- campcodes online examination systemCampcodes Online Examination System addExamExe.php sql injection5.3 Medium
- campcodes complete web-based school management systemCampcodes Complete Web-Based School Management System student_exam_mark_update_form.php sql injection5.3 Medium
drupal/corePackagistDrupal core Remote Code ExecutionNo scoredrupal/corePackagistDrupal Anonymous Open Redirect5.8 Medium- Show moreLoading…